There is block cryptography as one of cryptosystems. The block cryptography is classified as a common key cryptosystem in which the same key is used in encryption and decryption. The block cryptography is constituted by an encryption process and a decryption process. In the encryption process, a ciphertext is output using a target data for encryption (plaintext) and a key as an input. In the decryption process, plaintext is output using the ciphertext and the key as an input.
In the block cryptography, a key length and a block length are fixed. For example, in the common key cryptosystem AES, which is standardized by National Institute of Standards and Technology (NIST), the key length can be selected from 128 bits, 192 bits, and 256 bits, and the block length is 128 bits.
In a case where data larger than the block length is handled using the block cryptography, for example, the data is divided into a plurality of blocks, and encryption and decryption are performed for each block. Methods of using the block cryptography for handling data larger than a block length in this manner is called block cipher modes of operation.
Here, in a method of encrypting each block, when a portion of the ciphertext and the key are acquired, the acquired portions can be decrypted. Therefore, in order to prevent a portion of the ciphertext from being decrypted, a technique called All Or Nothing Transform (AONT) is used. A method of performing encryption and decryption using AONT is disclosed in, for example, Non-Patent Document 1 and Non-Patent Document 2.